SQL injection

SQL injection means introducing parts of SQL instructions through data processed by an application. If such values are inserted into a query's text, they can change its meaning. Which data can be read or modified depends, among other things, on the permissions of the database account used.

Separate the project filter from the query structure

A fictional ticket portal searches for entries belonging to a project reference. It treats the value from the projectRef field as a bound query parameter: the query structure is fixed, and the value is passed separately through the database interface. It should remain a search value rather than become part of SQL syntax.

Merely preparing a query after assembling it from input does not establish this separation. Previously stored data or values from other systems must not become unchecked SQL text when a later query is constructed either.

Bind values and keep structural choices fixed

A sort field such as sortKey is a different case. Placeholders for data values do not substitute for arbitrary column names or sort directions. The application therefore maps known selections to fixed columns and directions defined in code. OWASP explicitly describes this distinction between parameter binding and permitted structural choices.

Parameter binding also does not check whether the signed-in person may access the requested project. That authorisation check remains the application's responsibility. A database account limited to the necessary privileges can limit potential damage; it does not remove unsafe query construction itself.

Sources

• OWASP — SQL Injection Prevention Cheat Sheet